Security
What we actually do, not badges we have not earned.
This page describes controls that are implemented today. Where something is planned rather than built, it says so.
Encryption
- TLS for everything in transit, with HSTS and a strict Content Security Policy.
- The most sensitive fields — identity data, provider identifiers, MFA secrets — are encrypted by the application with AES-256-GCM before they ever reach the database.
- Each ciphertext is bound to its purpose and its row, so a value lifted from one column cannot be replayed into another.
- Encryption keys live in a secrets manager, never in the database's own configuration, and are versioned so they can be rotated without downtime.
Authentication
- Argon2id password hashing with cost parameters that are raised over time — and stored hashes upgrade themselves as members sign in.
- Two-factor authentication with TOTP and passkeys, plus single-use recovery codes.
- Refresh tokens rotate on every use. A token presented twice means it was captured, so every session in that family is revoked and a security event is raised.
- Sign-in failures are deliberately indistinguishable: an unknown address and a wrong password return the same error in comparable time, so the endpoint is not a user-enumeration oracle.
Account isolation
- Every query is scoped to one member in the application layer — and the database enforces the same boundary independently with row-level security.
- That second layer exists because the first is a discipline, and disciplines fail. A query that forgets its filter returns zero rows rather than someone else's credit file.
- The application connects as a role that cannot bypass those policies, and the platform refuses to start in production if that is not true.
- Cross-tenant access is tested adversarially: the suite tries to read and write another member's data and asserts that it cannot.
Data minimization
- We never store a complete account number — only the last four digits, for identification.
- Logs are scrubbed by a processor in the pipeline rather than by convention, so a stray log line cannot put a credit file into a log aggregator.
- Social Security numbers, dates of birth, tokens, credentials and complete report payloads are never logged at any level.
- Data classification is explicit — public, internal, confidential, restricted — and credit and identity data are restricted.
Access control
- Staff roles are separated by duty: support sees subscription state, compliance sees audit trails, administrators configure the platform.
- No role grants routine access to a member's credit file. Reading one requires a separate, justified, audited access grant.
- Every administrative action — role changes, flag changes, pricing changes — is attributable to a named actor.
- The audit trail is append-only, enforced by database grants and a trigger, so the application cannot rewrite its own history.
Responsible AI
- The AI reads member data through a tool layer built from data already scoped to that member. There is no query handle it could widen.
- Every tool is a read. There is no tool that moves money, files a dispute or writes to a bureau — so no prompt can reach one.
- Untrusted text from documents and provider payloads is fenced and labelled as data, so text shaped like an instruction is treated as an injection attempt.
- Model output is inspected before delivery, and prohibited claims are blocked or corrected rather than shipped.
What we have not claimed
Security pages are full of badges. Here is what ours deliberately does not have.
No certification claims
We do not display SOC 2, ISO 27001 or PCI badges, because we have not completed those audits. When we do, this page will say which report, which period, and how to request it.
No customer counts or ratings
No “trusted by 50,000 members”, no star ratings, no press logos. Inventing social proof is the fastest way to lose the trust this product needs.
No claim to be unbreakable
No system is. What we can say is that the controls above are real, that we assume breach in our design, and that our threat model is written down rather than implied.
No dark-pattern data collection
We collect the minimum needed to run the product. We do not sell your data, we do not share it for advertising, and the privacy policy says exactly what we hold.
Reporting a vulnerability
If you believe you have found a security issue, we want to hear about it. Our security policy describes what is in scope, what to expect, and our commitment not to pursue legal action against good-faith research.
Security you can read, not just trust
Every control on this page is implemented today.